feat(third_party): add Trello plugin

[minupalaniappan]

What this adds

A third_party/trello marketplace plugin for Atlassian's official Trello MCP server (https://mcp.trello.com/v1, Streamable HTTP, no /mcp suffix), plus its marketplace.json entry. Tracks Linear PGT-4579.

Cursor already ships a first-party Atlassian server (https://mcp.atlassian.com/v1/mcp), but it covers Jira and Confluence only; Trello is Atlassian's separate official MCP and is not reachable through it. 316 Grok Bot users hand-added mcp.trello.com in the last 30 days, so this gives them (and Cursor users) a one-click install.

Tools (12): trelloReadMember, trelloReadBoard, trelloWriteBoard, trelloReadCard, trelloWriteCard, trelloWriteList, trelloWriteChecklist, trelloReadInbox, trelloWriteInbox, trelloReadPlanner, trelloWritePlanner, trelloSearch. Tools are action-dispatched (action parameter) and take ARI ids. Names come from Atlassian's trello-use skill and README in atlassian/trello-mcp-server; the README notes the hosted runtime is the source of truth. Comments, attachments, custom fields, and members are not exposed yet (listed as planned by Atlassian), and the README says so.

Auth verification

• Anonymous initialize against https://mcp.trello.com/v1 returns 401 with a WWW-Authenticate header carrying a resource_metadata pointer (RFC 9728 protected-resource metadata).
• The authorization server is Atlassian's (https://auth.atlassian.com/<tenant>) with PKCE and dynamic client registration; users sign in with their Atlassian account and pick one Trello workspace on the consent screen.
• DCR returned 201 for every redirect set Cursor and Grok send, including Grok Bot mobile (grokbot://mcp/oauth/callback + https://www.cursor.com/bot/mcp/oauth/callback) and grok.com — no vendor allowlist work needed.

What to review

• plugin.json keeps the eToro/TinyFish shape (same fields, minClientVersions.cursor: 3.13.0, category: integrations) so it lists in Cursor and Grok Bot alike.
• Logo: Trello's official mark, extracted from images/Trello_logo_light.svg in atlassian/trello-mcp-server and rendered on a white 192×192 tile with 16px padding. Updated: mark now rendered at 160×160 with 16px padding to match sibling logos.
• node scripts/validate-plugins.mjs passes ("All plugins validated successfully.").
• Sibling plugin PRs opened the same day also append to marketplace.json, so expect a trivial array-tail conflict when merging in sequence.

Out of scope

• grok.com catalog connector for Trello.
• Hosted SERVER placement check for Grok Bot iOS after publish.
• Account-based end-to-end sign-in test, pending a Trello account.

---

Note

Low Risk
Adds marketplace metadata and a remote MCP stub only; no changes to Cursor core or auth implementation beyond listing the integration.

Overview
Adds a one-click Trello integration for Cursor by publishing third_party/trello and registering it in marketplace.json.

The plugin wires agents to Atlassian’s hosted Trello MCP (https://mcp.trello.com/v1) via mcp.json and documents OAuth (Atlassian PKCE, per-user workspace consent) in the README and changelog. It is separate from the existing Jira/Confluence Atlassian connector and exposes board, list, card, checklist, Inbox, Planner, and search capabilities through the remote server’s tools.

Packaging matches other third-party MCP plugins (plugin.json, MIT license, logo asset referenced in manifest).

^{Reviewed by Cursor Bugbot for commit 5bfb145. Bugbot is set up for automated code reviews on this repo. Configure here.}